O/T—Using Internet Explorer = Webpages can read your files

[MordEth]

Honestly, I don’t know how much my urging our members and guests to shy away from IE affects the visits here (in the last month, 42.69% of our visits were made by some version of IE), but if you haven’t already stopped using IE (at least at home), please stop now.

Fortunately, as far as we know, the latest Internet Explorer vulnerability isn’t being exploited in the real world (yet!), but that there is a flaw in the browser that allows a malicious site access to the contents of the entire C: drive is staggering. What this means is that your primary hard drive (and no doubt for most of you, this is the entire contents of your computer) can be available to anyone with administrative access to any of the sites you visit, if you’re using IE. When you think that this also could include whoever is providing advertising to these sites...

...hopefully you realize how alarming this is.

Please start using Firefox, Google’s Chrome, Opera or Apple’s Safari instead of IE. All of them are free, all of them are better browsers and all of them will keep you safer online. If you’d like to read more about the vulnerability that I was discussing above:

IE Windows vuln coughs up local files

One click bares entire C drive

By Dan Goodin in San Francisco
Posted in Security, 27th January 2010 21:53 GMT

If you use any version of Internet Explorer to surf Twitter or other Web 2.0 sites, Jorge Luis Alvarez Medina can probably read the entire contents of your primary hard drive.

The security consultant at Core Security said his attack works by clicking on a single link that exploits a chain of weaknesses in IE and Windows. Once an IE user visits the booby-trapped site, the webmaster has complete access to the machine’s C drive, including files, authentication cookies - even empty hashes of passwords.

This isn’t the first time security researchers at Core have identified security weaknesses in IE. The company issued this advisory in 2008 and this one in 2009, each identifying specific links in the chain that could potentially be abused by an attacker.

“Every time we reported this to Microsoft, they were fixing just one of the features,” Medina said in a telephone interview from Bueno Aires. “Every time they [fixed] it, we managed another way to build the attack again.”

Medina said he has fully briefed Microsoft on his latest attack, which he plans to demonstrate at next month's Black Hat security conference in Washington, DC. Microsoft's "rapid response team" didn't reply to an email, but a statement sent to other news outlets said the company is investigating the vulnerability and isn't aware of it being exploited in the wild.

The hole is difficult to close because the attack exploits an array of features IE users have come to rely on to make web application work seamlessly. Simply removing the features could neuter functions such as online file sharing and active scripting, underscoring the age-old tradeoff between a system’s functionality and its security.

Based on Medina’s characterization, it appears that fixing the weakness will require changes in a Windows network sharing technology known as SMB, or server message block, as well as the way Windows makes file caches available to a wide variety of applications.

“The things we are reporting are not bugs, they are features,” Medina said. “They are needed for many applications to work, so [Microsoft] can’t simply remove or truncate” them.

IE suffers from at least one other long-standing security bug that can enable attacks against people browsing websites that are otherwise safe to view. It can be exploited to introduce XSS, or cross-site scripting, exploits on webpages, allowing attackers to inject malicious content and code. Microsoft has said it’s unaware of this vulnerability being exploited.

Core’s previous advisories contain a number of workarounds, including setting the security level for the internet and intranet zones to high to prevent IE from running scripts or ActiveX controls. ®

(From The Register.)

And if you want to worry about other vulnerabilities: IE 8 has 3 advisories, IE 7 has 10 and IE 6 has 23. By comparison, the latest version of Firefox has 0, Opera has 0, and even Safari (with 1) and Chrome (with 1) are both safer and will no doubt be vulnerability-free again before IE will be.

Based on IE’s track record, it’s as good at keeping you secure online as a tissue is at being an umbrella.

Your friendly internet daemon,

MordEth